LAWYERSEXPERTS

KNOW THELAWEVIDENCE

California Computer Forensics Experts

Technical Resource Center is a full-service Computer Forensics Investigations Crime Lab.
We assist attorneys, corporations, and individuals with computer evidence collection, investigations, data recovery, and Expert Witness Testimony.
We have locations in Los Angeles California and Orlando Florida and provide services throughout the United States, including all of California.

Services

Our team of dedicated specialists looks forward to assisting you with your Computer Forensics and Cell Phone Forensics Investigations,
as well as your eDiscovery, Expert Witness, Evidence Preservation, and Data Recovery needs. We are experts in the following
investigations and services (please hover over photo):

Cell Phone Forensics Investigations - California

Cell Phone or Mobile Device Forensics consists of the extraction, preservation, analysis, and reporting of data located on
mobile devices in a forensically acceptable and court approved process. TRC can examine more than 9,500 different types of
cell phones and tablets, including the most popular devices on the market, the Apple iPhone and iPad, and Android-powered smartphones.

eDiscovery - California

The duty to preserve Electronically Stored Information (ESI) begins when litigation is reasonably anticipated. TRC has the
unique advantage of having worked on behalf of both plaintiffs and defendants. We have served as a "Neutral Expert for the
Court" on multiple Electronic Discovery cases. Ask about our distinctive process known as "Forensics eDiscovery."

Expert Witness Services

Our Lab Director, Neil Broom, has been appointed to the Los Angeles Superior Court Panel of Expert Witnesses for Computer Forensics.
Mr. Broom has been qualified as an Expert Witness multiple times in state and federal courts, in civil as well as criminal cases.
Neil is also the co-author of the book "Computer Forensics Jumpstart" and has trained over 3,000 students in Computer Security and Forensics.

Evidence Preservation - California

At times, simply preserving evidence for potential future litigation may be all that is necessary. TRC specializes in large collections
(over 50 computers) but can assist with any size forensics preservation. Windows based computers, Apple Mac devices, and mobile devices
(cell phones and tablets) can be collected, forensically preserved (including Chain of Custody), and returned to service quickly and professionally.

Data Recovery - California

Corrupted Operating System? Deleted photographs? Lost data? Our technicians can restore data from damaged computer hard drives, cell phones,
and USB devices and get you back to work quickly. Data Recovery can be a cost effective method to restore damaged devices as opposed to recreating
business data and sometimes it can be the only solution to recover the lost memories found in deleted photos.

Frequently Asked Questions

If you have any questions, please do not hesitate to contact us.

Computer Forensics FAQs

What exactly is Computer Forensics?

Computer Forensics is the use of specialized techniques for the preservation, identification,
extraction, authentication, examination, analysis, interpretation and documentation of digital
information. Computer forensics comes into play when a case involves issues relating to the
reconstruction of computer system usage, examination of residual data, authentication of data
by technical analysis or explanation of technical features of data and computer usage. Computer
Forensics requires specialized expertise that generally goes beyond normal data collection and
preservation techniques available to end-users or system support personnel.

What is Chain of Custody/Chain of Evidence?

Chain of custody is the record of the custodial history of evidence. The Chain of Custody shows,
"WHO had access to WHAT and WHEN did they have it."

Chain of Evidence or authentication is the record of the collection, processing, and analysis of
digital evidence. It proves that the presented evidence is unequivocally derived from the acquired digital information.

What is a Forensics Image?

A forensics image (sometimes called a forensics copy) is an exact bit-by-bit copy of a digital device (hard drive,
USB device, cell phone, etc.) including active data, slack space, unallocated space (or unused space). We use court
approved forensics tools for making these images. Our tools produce authentication information, called a hash value,
to ensure the integrity of the image.

What is a hash value?

A hash value is a mathematical algorithm produced against digital information (i.e. a file, a physical disk, or a forensics
image) thereby creating a digital fingerprint for that information. It is by purpose a one-way algorithm and thus it is
not possible to change digital evidence, without changing the corresponding hash values. In other words, if the hash value
of a file has not changed, the file itself has not changed.

A hash value, commonly referred to as an MD5, SHA-1, or SHA-256 hash (based on the algorithm used to produce the hash) is used to
authenticate digital evidence.

MD5 Hash Example: e6196e1b4f0d1535244eaab534428542

What is the difference between Computer Forensics and Digital Forensics?

Generally, the concepts overlap, however digital forensics may be the more contemporary expression and more inclusive, recognizing forensics
services directed at more types of devices besides those that have been traditionally considered computers, such as cell phones, landline
phones, cameras, sound recorders, personal digital assistants, networks including the Internet and others.

How much do computer forensics investigations typically cost?

The cost of a computer forensics investigation varies greatly, depending on the number and types of systems involved and the complexity of the
evidence recovered. Technical Resource Center knows how to ask the right questions to obtain an accurate quote for your investigation.

A complete examination of a single Terabyte hard drive may have over 200,000,000 pages of electronic information and may take between 15 to
100 hours to examine, depending on the amount of data, types of data, condition of the media and data, and the questions to be
answered.

A reasonable quote can be obtained prior to the start of the examination if complete and accurate information about the systems is available to
the examiner and the scope of the examination is clear (i.e. the questions that need to be answered). This time could increase or decrease,
depending upon the type of operating system used, the type of data contained within the system, and the size and amount of data in question.

At Technical Resource Center, our examiner's hourly rate is $350. In most instances, examination and reporting can be completed in less
than 20 hours and the complete analysis usually totals less than $7,000 for a single hard drive.

We do NOT charge an hourly rate for equipment operation time (i.e. when our personnel are not actively involved processing evidence, but only
periodically monitoring the processing). Some firms charge extra for the use of their computer hardware to process evidence.